top of page
Search
usakykuh

Avast Command Line Scanner: How to Run a Scan from the Prompt



Scan is the basic command line scanner that comes with Avast for Linux. It searches the givenPATH(s) for infected files and reports such files to the standard output. If no PATH is given, thescan paths are read from the standard input, line by line.




avast command line scanner




The ESET Security On-demand scanner can be initiated from both the graphical user interface and command line. Command line scanning is useful if your computer is currently operational only in Safe Mode or if you are a network administrator and want to initiate scanning from an external application.


To use the scanner, open a Command Prompt, reference the full directory path to the scanner followed by the list of objects to scan. Additional parameters (see Scanner options) can be appended to the command line to further modify your scan.


Here are a couple...Avast:"C:\Program Files\Alwil Software\Avast4\ashQuick.exe" %1ClamWin, I deleted my batch but it was something this, I am missing zip, rar& all that right now:clamscan.exe --database="C:\Documents and Settings\All Users\.clamwin\db" %1(clamscan.exe --help) as I recall giess the command lines, I do not have itinstalled right now... Back in the DOS days I used F-Prot McaFee & Norton (all DOS versions) & itworked pretty good, I thing I used AVP for DOS too. Download managers can run virus scanners & there is even a Firefox pluginto scan downloads so why not all of us slam AV.bat out? Now the way I see it is if there is little space on a hard drive or littleresources on a computer call should be used such as:call avast %1call clamwin %1 There are tons of AV programs out there but if anyone has compatable ones Ivery much would like to see it! Thanx everyone!


It is something like "c:\windows\application data" do dir/s/b to find the.clamwin directory, as I recall there are two directories with that name. I did try out Bitdefender & it seems to trash other .DLL files so Iabandoned it totally, Solo Antivirus has a command line scanner too (I donot have it on my system (Shareware) but as I recall Solilte is the commandline program in it. Here is my most up to date bat...--------------------------------------------------------------


rem a-squared"C:\Program Files\a-squared Command Line Scanner\a2cmd.exe"/a /d %1rem This is a old outdated Norton command line scanner for DOS,C:\NAVC\NAVC.EXE %1 /DOALLFILES /ZIPrem AVG, this is a very good one!


Afterwards, a C&C request-response loop is started. Based on the response from the C&C server, one of the following commands is executed: download files, upload files, sleep, quit, or execute commands on a command line. See the following diagram for a detailed flow, keep in mind that all download/upload are using the aforementioned Dropbox API:


This binary is a simple filescanner that is provided with a list of file extensions, a list of directories, and date boundaries as parameters. Every directory from the list is searched for files with a given file extension. If such files are found and their modification date is within the provided date boundaries (in UTC), their full paths are written down into the output file. These paths are delimited by Windows line delimiters and they are encoded in 16-bit Unicode.


This backdoor is simpler in terms of commands than the previous one. It accepts just four commands: exit, upload, download, and execute on the command line. Nevertheless, it uses two layers of C&C servers, meaning that the first request is on the first layer, and it yields an IP address of a C&C server from the second layer. Afterwards, the request-response C&C loop uses the second layer. If the backdoor receives a command for the command line, the output from the console is encrypted with AES-256 and sent back to the second-layer C&C server.


The obtained data is encrypted with AES-256, using the aforementioned approach with GUID as a base-string for the key-derivation procedure. Each response also contains the random number that was sent in the first second-layer request. The malware checks whether the received number matches the one it sent; in case of a mismatch, the command is discarded. If a command for the command line is received, the output of the executed command (AES-256 encrypted, using the same key as the previous response, and Base64 encoded) is sent to


Avast provides a Command-line Scanner for users of the Avast professional edition. This feature involves a command line to carry out scans using various switches and parameters. A special STDIN/STDOUT mode is also available. Unfortunately, the command line is not available in ByteFence.


The new avast! Pro Antivirus 5.0 uses the same core detection engine with more customization options. "It offers a few extra functions aimed at more advanced users, small businesses or technical experts who want to integrate avast! into an existing, best of breed, security solution," says Mr. Steckler. "These advanced features include real-time script inspection, a command line scanner and the new sandboxing technology for safely examining suspicious file activity.


The new avast! Internet Security provides comprehensive security for on-line shopping and banking. It provides protection against threats from infected web sites and the growing risk of identity theft. As the premium avast! product, it contains an intelligent firewall and a comprehensive anti-spam/phishing module in addition to the antivirus, anti-spyware, anti-rootkit, scriptblocker and other real-time shields. avast! Internet Security can be licensed for 3, 5 or 10 computers starting at $59.95 for 1 year protection.


ClamWin needs the location of the virus definition database in the command line, the default is C:\ProgramData\.clamwin\db in Windows Vista/7/8 if you installed it. To check the current location of the virus definition database, run the ClamWin program and go to Tools -> Preferences -> File Locations.


The free edition does not support command line scanning in the same way as the Internet Security or Pro versions although it has a quick scanner tool with no arguments apart from a drive letter, this will simply popup a message if it detects anything suspicious during the scan.


There are number of other command line arguments to use in USBVirusScan such as hiding the program from the tray (-i), disabling the exit button in the tray (-e) and scanning all removable drives when the program starts (-s) etc. Double click the executable or right click on the tray icon -> About for the full list of supported arguments.


avast! 5.0 is a free antivirus program available for Windows 7, Windows Vista, and Windows XP. It is a fairly full featured virus scanner similar to AVG free. Some of its key features are:


Unlike other Bootable Scanners, the Panda USB Vaccine runs through the command line. You can customize the scanning process as per your requirements right from the command line. When you enable this feature, the system will automatically be scanned via this tool. Before the system starts, it will be scanned properly through this USB Vaccine tool. This tool can only be used on Windows OS.


And much of that time is spent doingreverse-DNSresolution.Excluding that by adding -n to the command-line abovereduces the 4096-host scan time to 193 seconds. Being patient for threeminutes is far easier than for the 21 minutes taken before.


Sometimes a story is the best way to understand decisions, such as how I decided upon the command lines in the solution section.I was bored at home, and started exploring the network of a popular magazine namedPlayboy. Their main site includes a huge trove of images, but most are locked away behind a paid subscription authentication system. I was curious as to whether I could find any other systems on their network which offer up images for free. I figured that they might have staging or development servers which rely on obscurity rather than password authentication. While such servers could theoretically listen on any port number, the most likely is TCP port 80. So I decide to scan their whole network for that open port as quickly as possible.


Next I want to estimatelatencyto these machines, so that Nmapwill know what to expect. This isn't required, but feeding Nmapappropriate timing values can speed it up. This is particularly truefor single-port -Pn scans, such as this one. Nmapdoes not receive enough responses from each host to accuratelyestimate latency and packet drop rate, so I will help it out on thecommand line. My first thought is to ping their main web server, asshown in Example 4.6.


If Windows Defender offline scan stops at 93/92 or any other % via the Windows Defender app, you can try another way to check if it is still not working. Command Prompt is a command-line tool that allows you to do many operations including performing an offline scan.


The ESET installation process returned to the .deb package method, and proved fast and efficient. On-access scanning could be implemented using either dazuko or the Samba VFS path, and the latter was adopted at the request of the developers. This proved simple to get working once I had navigated my way around the setup, and again the command-line scanner was a joy to operate.


I operated on-demand scanning via the command line as usual, and other tests also proceeded normally after a few tweaks to the settings via the GUI. Scanning speeds were fairly languid once again, but scanning levels were thorough and detection equally in-depth. Just when all was looking up, the same tool that tripped up F-PROT was alerted on, this time being labelled an Ircbot trojan. This meant that F-Secure was also denied a VB100 award this month, and as the alert was marked as originating from the AVP engine, more upsets were expected.


Kaspersky uses the .deb package method for its install, but this time it seemed to do little more than place the required software in the right spots; exactly where these spots might be was left somewhat unclear. After some rummaging around I found the manual pages and linked them in with the man system, which shed some light on how to proceed. Post-install scripts had doctored my Samba configuration to include the VFS on-access scanner, which was fairly simple to configure. The command-line scanner operated in a fairly normal way too, although it had an unwieldy title and required to be run as root to access its own configuration files. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments


bottom of page